But it does not bring the tunnel up. In debug it appears to not even be attempting to initiate. I can see that the access list applied to the crypto map is not being hit.

HOWEVER when I add the untranslated subnet to the access-list, i.e.,:

access-list 173 permit ip 172.25.0.0 0.0.255.255 10.3.0.0 0.0.255.255

access-list 173 permit ip 172.24.0.0 0.0.255.255 10.3.0.0 0.0.255.255

I can see the hit count incrementing for 172.24.0.0/16!!! I'm not sure how this is possible when it has been translated. This also brings the tunnel up (but not fully, as it's not configured on the other end, I'm just using it for testing).